Lookout

• GIF

• 

  How Lookout works: one engine reads the message, call, and number, then returns one verdict (allow, verify, or hold).

• 

  An AI agent on a real phone line, inbound or outbound, and the number it catches is reported back to the shared database.

Inspiration

Every heist has a lookout who watches the door and calls it off before the crew gets caught. Scam victims never had one. We built Lookout to be that for their money.

Imagine: A 74 year old gets a call from "the IRS." There is a warrant, she has to wire $2,000 now, and tell no one. She is not careless, she is being run by a professional, and eleven minutes later the money is gone. Her bank did nothing wrong by its own rules, because she approved the payment herself. The fraud is in the conversation, not the login. In 2025 the FBI counted $20.9 billion lost to internet crime, $7.7 billion of it from people over 60. 60% more than last year!! We built the alarm that trips before the time ticks away.

What it does

Lookout is a scam check a credit union drops into the payment flow it already has. When a member sends money, it reads the message or call behind the payment, checks the number against a scam database, scores the risk from 0 to 100, and returns one plain verdict: allow, verify, or hold.

On a hold, the money freezes on a "heist in progress" screen, a calm warning plays aloud in English or Spanish, and a trusted contact the member picked ahead of time gets a one tap approve or deny. Only a person can release it.

Two things make it more than a spam filter. An AI agent answers a real phone line, inbound or outbound, listens to what a caller says, and gives a verdict in plain words. And every number it catches gets reported into a shared database, so the scammer's next target is already warned.

What it won't do

It never moves or releases money on its own. It never asks for a password or a code. The wallet is a demo that stands in for the bank's app, so the real integration is one /check call before the transfer. A flagged number is a signal, not proof, and everything has an offline fallback so it still works with no keys.

How we built it

Next.js and FastAPI run the app and the single /check endpoint a bank calls. Gemini reads the words and writes the reasons and the agent's replies, in English and Spanish. A plain scoring function makes the final call, so no single signal can hold a payment alone. ElevenLabs is the voice, Twilio runs the phone line both ways, and the number check sits on public data from the FTC Do Not Call list, the FCC, and IPQualityScore. Tiger Data stores every check and powers the live chart, Vultr hosts it, and the domain is on GoDaddy Registry.

Challenges we ran into

Single words lied. "Police" and "urgent" show up in normal messages too, so we score on patterns stacking up and made one signal never enough to hold a payment. Getting the agent onto a real phone meant working around a blocked network transport. And every point in the score has to map to a reason on screen, which is the part a credit union will actually trust.

What we learned

The fraud is in the conversation, not the login. Being able to explain a hold is what earns the right to pause someone's money. Building for seniors first made the whole thing clearer for everyone.

What's next for Lookout

Pilot the /check layer inside one credit union's real transfer flow, and grow the shared database so one person's report protects the next target.

Built With

• elevenlabs
• fastapi
• gemini
• godaddy
• google
• next.js
• postgresql
• python
• react
• timescaledb
• twilio
• typescript
• vultr